JP2002041464A - Method and device for identifying end-user transaction - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an automated system for identifying an EUT by using an RPC sequence recorded on a server. SOLUTION: These method and system are explained, in order to perform end user transaction recognition based on server data such as the sequence of remote procedure calls(RPC). The method may include a machine learning method for pattern identification, such as Bayesian classification for segmenting the RPC sequence, a function-extracting mechanism and a dynamic programming approach. The method desirably includes a learning engine and an operation engine. The learning engine may include a data preparation subsystem (function extraction) and a Bayesian network learning subsystem (model construction). The operation engine may include transaction segmentation and a transaction classification subsystem.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

FIELD OF THE INVENTION The present invention relates generally to managing distributed systems, and more particularly to recognizing end-user transactions that include a sequence of Remote Procedure Calls (RPCs) received at a server.

[0002]

BACKGROUND OF THE INVENTION Providing good services (eg, low response times) to end users of distributed information systems is essential for e-commerce, among other applications. An important step in managing the performance of such a system is to model the behavior of the end user. Realistic end-user models include (a) a good measure of end-user perception of performance, (b) generating a representative workload,
(C) providing good resource management; and (d) improving the maintainability of the system by recognizing potentially dangerous end-user behavior patterns.

[0003] The first step in building an end-user model is the end-user transaction (EUT).
Is to characterize The EUT allows the end user to issue a series of commands issued to the end user's workstation, such as opening a database, opening a view, reading some records, and closing a database. Including. In distributed systems, those commands result in remote procedure calls (RPCs), which are typically sent from a user's workstation to one or more servers. To illustrate the foregoing, we have
Use the tus Notes ™ email system. Common RPCs such as OPEN_DB, READ_ENTRIES, and F
IND_BY_KEY. Given such a chronological sequence of RPCs from the same end user, we want to confirm the start and end of the EUT and label each type. Examples of an EUT in Lotus Notes include note search, note update, and screen display means.

[0004] Due to the large number of end-user workstations, and often not the responsibility of administrative staff, there is often little opportunity to gather information about the EUT from the workstations themselves. Rather, it is EUT information RP
The server is obtained in the form of a C sequence. Unfortunately, the server has little information about the end-user transaction. In principle, the client-server protocol is dedicated to marking the start and end of a user interaction. However, this is not enough to identify the EUT. This is because users often view a series of application interactions as a unit of work. By convention, for such problems, either using a surrogate for the EUT (eg, a synthetic transaction generated by a search station) or manually marking the EUT for post-processing. Work by. The former often causes erroneous quality of service assessments. On the other hand, the latter is quite time consuming.

[0005]

Therefore, there is a strong demand for having an automated system for recognizing an EUT using an RPC sequence recorded on a server.

[0006]

SUMMARY OF THE INVENTION The present invention provides a method and system for recognizing an end-user transaction that includes a sequence of remote procedure calls (RPC) received at a server. Such a method is important in providing good quality service (eg, low response time) to end users of the information system. (B) generating a representative workload, (c) providing good resource management, and (d) providing, among other things, (d) a good measure of end-user perception of performance. 2.) It is possible to improve the maintainability of the system by recognizing potentially dangerous end-user behavior patterns.

The present invention proposes using machine learning techniques for recognizing the EUT to adapt some well-known methods to the specific structural properties of our domain. Briefly, the EUT recognition problem has two problems. The first problem is to segment the RPC stream (from each user) into transaction instances (segmentation problem). Second
The problem is to label segments with the correct transaction type (classification problem). The segmentation approach of the present invention is to use dynamic programming, which allows for efficient reuse of previous computations. For classification, the present invention uses the Bays Net framework (see Pearl, Judea, "Proba
bilisticReasoning in Intelligent Systems ", Morgan
Kaufmann, San Mateo, CA, 1988, incorporated herein by reference). B
ayes Net is a graphical framework for inferring under uncertainty, encoding stochastic dependencies (represented by stochastic variables) between entities of interest and given data Allows predictions about unobserved entities. In the present invention, we want to predict the EUT type given to an RPC sequence encoded by a set of functions. Bayes Net is a directed undirected graph (a graph having a directed edge without a directed cycle) in which random variables corresponding to nodes and stochastic dependencies are represented by edges. Each node has an allowed set of variables called the variable domain. Bayes Nets, also called causal networks, because directed arcs can often be interpreted as causal dependencies between variables. Ba for classification
Using yes net is attractive for several reasons. First, Bayes Nets provides robust probabilistic reasons that allow for a good interpretation of the results (comparison, for example, with some other models such as neural networks with less clear semantics). Based on. Second, Bayesian frameworks often allow for the capture of domain knowledge as important as the information obtained purely from the data. Third, Bayes Nets makes it possible to learn causal dependencies rather than simple correlations of data.

[0008] The problem of recognizing end-user transactions has not yet been addressed in the literature. However, the problem of recognizing the EUT is heavily related to some well-studied machine learning domains, such as pattern recognition, document classification, and speech recognition. A common pattern recognition problem is assigning one of the predetermined class labels to a predetermined instance represented by its function vector. For example, in document classification, the task determines which given heading (class label) is most relevant to a given text document (instance). Text documents are
Represented by a set of functions, such as word occurrences of word counts. A classification algorithm trained on a set of text instances labeled by the correct headings (training data) assigns headings to text instances that are not already seen (test data). Examples of document classification applications include web page classification, e-mail or news article sorting, and learning for user reading (eg, Mi
tchell, Tom M., "Machine Learning", New York: McGr
See aw-Hill, 1997. This document is incorporated herein by reference). Also an important part of pattern recognition is the function selection problem, where a function type (e.g., word occurrence or word count in text classification) is selected, and then a predetermined function that is particularly important when the number of functions is large It involves selecting a subset consisting of the most useful functions of the type.

[0009] Despite the similarities due to text classification, the EUT recognition problem is inherently more complex. Because it requires first segmenting the RPC sequence into segments representing different EUTs, and then labeling those segments with the EUT. Some work on the segmentation problem involves speech recognition where the stream of sound is segmented into words (eg, Jelinek, F., "Statistica
l Methods for Speech Recognition ", Cambridge: MIT P
See ress, 1998. Statistical natural language processing in which sequences of words must be segmented into phrases (eg, D. Beeferman, A. Berger, and J. Lafferty, "Sta."
tistical Models for Text Segmentation, "Machine Le
arning, special issue on Natural Language Learnin
g, C. Cardie and R. Mooney (eds.), 34 (1-3), pp.177
See -210, 1999. This document is incorporated herein by reference). The standard approach in speech recognition is to use Hidden Markov Models (HMM) to model the dependencies between successive sounds. However, the domain of the present invention is Dynamic
Requires a more complex dependency model that leads to a more general framework for Belief Nets. Also, our domains provide certain structural properties that are not currently required by other domains, and can significantly improve the efficiency of our systems.

Accordingly, there is provided a system and method for recognizing an end-user transaction using an RPC sequence recorded on a server. Our approach has several innovative aspects. For example: (1) We address EUT awareness issues that were not previously solved in distributed system performance management. (2) We provide a system and method for automatic EUT recognition based on the application of machine learning techniques to this new domain. (3) Instead of manual labeling,
We also propose a method for automatic generation of training data in the learning system. The method includes providing a transaction creation agent to both the client and the server.

[00011] In one aspect of the invention, the architecture of the invention comprises an EUT model learner component and an EUT recognizer component corresponding to two phases of the EUT recognition process, a training phase and an operation phase. You. In the training phase, the EUT model learner derives the EUT Bayes Net Mode from a set of training data consisting of a series of RPCs labeled with the corresponding EUT.
Make up l. Training data is currently produced by human experts. In the operation phase, the EUT recognizer uses the EUT model to generate EUT labeling for the incoming unlabeled RPC sequence. The function selection component of the present invention acts as a filter that transforms the input RPC sequence into a set of EUT functions for use in the next classification.

In another aspect of the invention, a method of the invention selects a data structuring step, an EUT function, and an EUT function.
It involves learning a model and using this model to recognize the EUT.

Bayes Net used in the system of the present invention
The classifier includes a root node corresponding to the EUT type, where the root node indicates a set of functions representing functions such as occurrence or count of each RPC type. One E
Under the condition that the RPC sequence corresponds to the UT, the function extraction mechanism assigns values to the function nodes,
The Bayer Net classifier finds the most promising class (EUT label) for that assignment.

The EUT recognizer segments the incoming RPC stream into sequences corresponding to different EUTs and labels them with the appropriate EUT using a Bayes Net classifier. The quality of the segmentation is controlled by a quality metric. That is, the segmentation / labeling process is repeated until a satisfactory distance value is reached.

Finally, the present invention provides a method for automated marking of EUTs at client and server sites, which allows for unlimited generation of training data. This ingenious process replaces the time-consuming process of generating training data by current human experts or software, again using manually constructed heuristics. The creative process also improves the quality of the training data.

The present invention provides several advantages that do not exist in existing state of the art performance management of distributed systems, some examples of which are described herein. First, automated EUT recognition provides a better way to quantify end-user perception of system performance, which is essential in providing better service. Second, EUT recognition provides a realistic end-user model used to generate the typical workload needed to test the behavior of the system under various environments. Third,
Realistic end-user and system models are essential for better resource management. Finally, such a model can be used to provide good security based on comparing typical and atypical patterns in user behavior.

The above and other objects, functions and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the accompanying drawings.

[0018]

DETAILED DESCRIPTION OF THE INVENTION The present invention is described below in terms of an illustrative system architecture. However, the invention is not limited to any particular system architecture or particular type of end-user transaction (EUT). Rather, the present invention applies to any system architecture and any type of EUT than it is desirable to recognize the EUT using a remote procedure call (RPC) sequence to provide modeling of end-user behavior. On the other hand, it applies even more generally.

The present invention can be realized as hardware, software, or a combination of hardware and software. A typical example of execution by a combination of hardware and software is execution in a computer system having a predetermined program. In such a case, the predetermined program is loaded into the computer system and executed, whereby the program controls the computer system and executes the processing according to the present invention. This program is composed of a group of instructions that can be expressed in any language, code, and notation. Such instructions can be used by the system to directly perform certain functions, or 1. Conversion to other languages / codes / notations And / or duplication to another medium. Of course, the present invention includes not only such a program itself but also a medium on which the program is recorded. The program for executing the function of the present invention is a flexible disk, MO, CD-
ROM, DVD, hard disk drive, ROM, MR
It can be stored in any computer-readable recording medium such as AM and RAM. Such programs are:
For storage in the recording medium, it can be downloaded from another computer system connected via a communication line or copied from another recording medium. Further, such a program may be compressed or divided into a plurality of pieces and stored in a single or a plurality of recording media. This will be described with reference to FIG. FIG. 1 is a block diagram for explaining an overall architecture of an end-user transaction recognition system according to an embodiment of the present invention in terms of a network to which the present invention can be applied. As shown, the end user 100 issues a series of high level commands (eg, commands to open a database or read mail) called an end user transaction (EUT) 101. Send it to the workstation (client) 102. In a distributed system, as is known, each EUT sends a series of remote procedure calls (RPC) 103 from a user's workstation 102 to one or more tier servers 104 that process the RPC 103. It should be understood that the client workstation 102 and the server 104 may be a computer system linked by a network. The network may be a public network (eg, the Internet), a private network, and / or any other suitable network. In any case, the sequence of RPCs along with other information, such as session, time etc.
It is stored in the file 105. However, on the server E
No information about the UT is available.

Thus, as shown in FIG. 1 and in accordance with the present invention, the EUT recognition system 110 uses
UT model learning unit 120, EUT model 130, and E
It is provided as having a UT recognizer 140. In the training phase, EUT model learner 120 learns EUT model 130 that will be used later by EUT recognizer 140 in the operation phase. EU
The T model learner 120 uses the input training data including the RPC sequence labeled by the EUT. In one embodiment, obtaining the training data is accomplished by a human expert 106 that reconstructs the ETU sequence from the RPC sequence stored on the server 105 in the log file 105. According to another embodiment of the present invention, as shown in the configuration of FIG. 10, the distributed system environment is replaced by an automation system (training data extraction system) 107 for human experts to extract training data. It is configured as follows. Therefore, rather than requiring human experts, E based on training data
The UT-labeled RPC can be automatically generated by the training data extraction system 107.

In any case, the EUT model 130 constructed by the EUT model learning device 120 is
Used by the T recognizer 140 and viewed as an input RPC sequence stored in the server log file 105.

As further described in the configuration of FIG.
The EUT recognition system 110 and the training data extraction system 107 shown in FIG. 1 may be provided on the server 104 or another computer system.

Referring now to FIG. 2, a flowchart is provided to illustrate an overall end-user transaction recognition methodology in accordance with one embodiment of the present invention. It can be seen that the first three steps include a training phase. In step 200, input RPC data is constructed in the training data such that the RPC sequence from the server is labeled by the corresponding EUT. As described above, this may be performed by the human expert 106 (FIG. 1) or automatically by the training data extraction system 107 (FIG. 1). Next, in step 201, the EUT function is selected. The EUT function is used at step 202 to build an EUT model. Finally, step 203 is the operation
System, where the EUT model is used to recognize the EUT corresponding to the unlabeled RPC sequence.

A description will now be given with reference to FIG. FIG.
FIG. 3 is a block diagram for explaining an end-user transaction model learning device according to an embodiment of the present invention. In particular, FIG. 3 illustrates the EUT model learning unit 120 of FIG.
2 shows the components of the EUT model learning device module such as
As shown, the model learning device 120 has an EUT function selector 300 and an EUT Bayes Net learning system 310. EUT function selector 300 is responsible for selecting certain features of the RPC sequence, such as the appearance of several RPC Rs in transaction T. Such features are key components of the EUT model and are later used by the EUT recognizer as corresponding different EUT characteristics (functions). The RPC stream labeled by the EUT (training data) filtered through the EUT function selector contains the input to the EUT Bayes Net learning system and is the EUT Bayes Net model 1
30 is output.

Referring now to FIG. FIG. 4 is a block diagram for explaining an end user / other transaction function based on one embodiment of the present invention. In particular, FIG.
UT function selector, for example, EUT function selector 3 in FIG.
00 is described. As shown, the EUT function selector 300 includes an EUT function type selector 400 and an EUT subset selector 401. First, the EUT functional selector 400 determines whether the segment and the labeled RP
In response to the C stream 108, the type of function (RPC stream characteristics) considered in the model is determined. Possible functional types are, for example, the appearance of a single RPC, or R in the EUT.
It may include binary functions such as PC groups (pairs, triplets, etc.) and integer functions such as corresponding occurrence counts. Once the function type is selected, E
The UT function subset selector 410 calculates the corresponding function for a given input and determines the function with the highest value based on some evaluation distance (eg, the most useful function for mutual information between the function and the EUT level). Select only a subset. Therefore, the EUT function selector 40
1 acts as a filter that converts each RPC subsequence labeled with the EUT into a corresponding collection of functions (functional vectors) with the same EUT label.

FIG. 5 illustrates an end-user transaction Bayes used in accordance with one embodiment of the present invention.
This is to explain the Net model. In particular, FIG. 5 illustrates an EUTBayes Net model, such as the EUTBayes Net
This is for explaining the model 130. As shown in the figure, the root node 500 represents the EUT type, while the lower nodes (child nodes) 500-1 to 500-1
0-N represents the EUT function. The root node 500 is associated with the previous probability distribution, while each functional node "
fN "is associated with the conditional probability distribution of this function given the EUT type. For example, the conditional probability distribution associated with function 2 is represented as P (f2 | EUT, f1).

FIG. 6 is a block diagram illustrating an end-user transaction Bayes Net learning system according to one embodiment of the present invention. In particular, FIG.
T Bayes Net (BN) learning system, for example E in FIG.
This is for explaining the UT BN learning system 310. As shown in the figure, the BN learning system is based on Bayes Ne
The t structure learning module 600 and the Bayes Net parameter learning module 620 are provided. The BN structure learning module 600 learns the graph structure of EUT Bayes Net. E
Under the condition that the UT is an input sequence of labeled EUT function vectors, the module 600 learns the dependencies between the functions and generates a Bayes Net graph. An example of a Bayes Net graph structure is shown in block 610. The BN parameter learning module 620, which is the second component of the learning system, learns the parameters of Bayes Net and, under the condition of the structure, both the dependency between functional nodes and the probability distribution corresponding to each node. Generate an EUT Bayes Net model that specifies Block 6 of an example Bayes Net model
30.

FIG. 7 is a block diagram illustrating an end-user transaction recognizer according to an embodiment of the present invention. In particular, FIG. 7 illustrates an EUT recognizer, for example, an EUT recognizer such as EUT recognizer 140 of FIG. The EUT recognizer has an RPC stream segmentation system 700, an EUT function extractor 710, and a Bayes Net classifier 720. After the training phase has been completed, as described above, the resulting EUT Bayes Net model is available to the EUT recognizer. In general, the recognition is used as an input, ie, an RPC sequence from the server log file 105, which divides the sequence into segments corresponding to the EUT, labels the segments with the corresponding EUTs, and labels the resulting segments and labels. And outputs a modified RPC sequence 150. In particular, the RPC stream segmentation system 700 includes two other parts: a function extractor 710 and a classifier 7
20 during the segmentation process. EU
The T function extractor obtains information about the function to use from the EUT Bayes Net model and extracts the function from the input data. BayesNet classifier is the most likely EU
Outputs a T-label (class label), which is provided to the RPC segment selected by the RPC stream segmentation system. Therefore, the output of EUT recognizer 140 (block 150) is E
RPC sequence segmented and labeled by UT (RPC segment and transaction labels, eg, TxA, TxB, TxC) (eg, represented as blocks numbered 1, 2, 3, 4)
It is.

FIG. 8 is a diagram illustrating Ba according to an embodiment of the present invention.
It is a block diagram for demonstrating yes Net classifier. In particular, FIG. 8 illustrates a Bayes Net classifier, such as the Bayes Net classifier 720 of FIG. EUTBayes
E given by the Net model and function extractor 710
Under the condition of the value of the UT, the classifier performs the following tasks. First, at step 800, the classifier assigns an EUT function value to a corresponding function variable. In step 810, the classifier finds a later probability distribution for the ETUT variable. Next, in step 820, the classifier determines that the EU
Select the most promising EUT value for a given EUT function based on a subsequent probability distribution for the T variable. And Ba
yes Net classifier uses this most promising EUT value for a given EU
Output as the class label of the T function vector.

FIG. 9 illustrates an overall method for use by an end-user transaction recognizer during an operation mode (as compared to a training mode) according to one embodiment of the present invention. It is a flowchart of FIG. In step 900, the recognizer reads the RPC stream from the server log file 105. Next, the RPC stream is EUT in step 910.
Segmented into segments (RPC stream
Segmentation system 700). In step 920,
An EUT function vector is calculated for each segment (EUT function extractor 710). Based on such function vectors, Bayes Net classifier 720 calculates the EUT labeling of the segment in step 930. The quality of the segmentation and labeling is evaluated at step 950 using predetermined quality metrics from block 940. If the quality is sufficient, the recognizer proceeds to step 9
Output the resulting EUT labeling of the 60 split RPC streams. Otherwise, the process returns to step 910 and repeats.

FIG. 10 is a block diagram illustrating a system for automatic labeling of remote procedure calls by end-user transactions in accordance with one embodiment of the present invention. Reproducibility As described in the configuration of FIG. 1, the EUT recognition system of the present invention uses the human expert 10 for labeling RPCs by the EUT.
6 or operated by the automation system 107, for example provided in accordance with the invention and illustrated in the configuration of FIG. As shown, the end user 1000 sends a transaction to the end user's workstation 1002. Here, the start and end of each transaction is the EUT marker agent 101 residing on the client workstation.
Marked by 0. It should be understood that this agent 1010 is downloaded to the client's computer during the current or previous session with the server 1003. Another approach is to use an artificial workload generator 1001 that generates a transaction sequence. In addition, the EUT
Multiple RPCs captured by another EUT marker agent 1010 residing on server 1003
Yields a sequence consisting of R with EUT mark
The PC sequence is sent to the EUT label device 1020. The EUT label device 1020 includes a plurality of EUT-labeled RPCs used as input (training data) for the EUT learner module 120 (FIG. 1).
A sequence consisting of 1030 is output.

FIG. 11 shows a system for automatic labeling of RPCs by the EUT (FIG. 10) shown and described in detail herein, and various functional components / modules of the EUT recognition system (FIG. 1). It is intended to describe a generalized hardware architecture of a computer system suitable for implementation. It will be appreciated that the individual components of the EUT recognition system and the automatic labeling system can be implemented on one such computer system. Also, the individual components of the subsystem and the storage repository can be implemented on separate such computer systems. The components shown in FIG. 11 may be part of a server computer system with which the end user's client workstation transacts, or one or more other computer
It will be appreciated that it may be part of a system.

As shown, the computer system may be realized by a processor 1100, a memory 1110, and an I / O device 1120.
The term "processor" as used herein is intended to include any processing device, such as a CPU (Central Processing Unit) and / or other processing circuits. The term “memory” as used herein refers to a processor or CPU, such as RAM, ROM, fixed memory device (eg, hard drive), removable memory device (eg, flexible disk), and flash memory. Is intended to be included. Further, as used herein, the term “input / output device” or “I / O device” refers to one or more input devices, such as, for example, a keyboard for inputting data to the processing device, and / or the processing device. It is intended to include a CRT display and / or printer for displaying relevant results. It will also be appreciated that the term "processor" refers to multiple processing devices, and that various elements associated with one processing device may be shared by other processing devices. Accordingly, as described herein, a software component that includes instructions or code for performing the methods of the present invention may include one or more associated memories.
It may be stored on a device (eg, ROM, fixed or removable memory) and, when ready for use, partially or fully loaded (eg, R
AM) and further executed by the CPU.

Thus, as described herein, the method and system include a remote procedure call (R
This is described for end-user transaction recognition based on server data, such as a sequence of PCs. The method may include machine learning techniques for pattern and recognition, such as Bayesian classification, and a dynamic programming approach to segmenting RPC sequences. The method preferably combines an information-theoretic approach and a machine learning approach. The system preferably includes a learning engine and an operations engine. The learning engine consists of a data preparation subsystem (function extraction) and a Bayes Net learning subsystem (model construction)
May be included. The operations engine may include a transaction splitting and transaction classification subsystem.

While the representative embodiments of the present invention have been described with reference to the drawings, the present invention is not limited to these specific embodiments, and various other changes and modifications may be made in the present invention. It will be understood that those skilled in the art can perform the above without departing from the scope or spirit of the invention.

In summary, the following is disclosed regarding the configuration of the present invention. (1) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. An apparatus for recognizing one or more end-user transactions, comprising: (i) obtaining the one or more remote procedure calls; and (i)
i) at least one processor capable of recognizing one or more end-user transactions associated with the one or more remote procedure calls;
A memory coupled to the at least one processor and storing at least a portion of a result associated with the operation of the end-user transaction recognition. (2) the at least one processor further comprises: (i) segmenting the one or more remote procedure calls into a plurality of end-user transaction segments; and (ii) extracting an end-user transaction function for each segment. And (ii)
i) performing the end-user transaction recognition operation by calculating the one or more end-user transactions from an end-user transaction function for each segment using a model generated from training data. The end-user transaction recognition device according to the above (1). (3) The end-user transaction recognition device according to (2), wherein the model is a Bayes net model. (4) said at least one processor: (i) assigning a function value associated with the Bayes net model to a corresponding extracted function; (ii) a subsequent The end-user transaction recognition apparatus according to (3), further comprising: finding a probability distribution; and (iii) selecting a function representing one or more end-user transactions based on the subsequent probability distribution. (5) The function value selecting operation includes selecting a most probable function value for a predetermined extracted function to represent one or more end-user transactions. An end-user transaction recognition device according to 4). (6) The end-user transaction recognition apparatus according to (4), wherein the selected function value forms a class label of one or more end-user transactions. 7. The end-user transaction recognition of claim 1, wherein at least a portion of the result is compared to a quality metric to determine whether the result is of sufficient quality. apparatus. (8) The one generated at the client workstation from one or more remote procedure calls received at a server communicating with the client workstation in response to one or more end-user transactions. An apparatus for generating a model used in recognizing one or more end-user transactions, the method comprising: (i) obtaining one or more remote procedure calls labeled by one or more end-user transactions. And (ii) the model learns from the labeled one or more remote procedure calls and includes one or more selected functions labeled with the one or more end-user transactions. Calculating; and (iii) prior to said selected function Model generation comprising: at least one processor capable of building a model; and a memory coupled to the at least one processor and storing at least a portion of a result associated with an operation of generating the model. apparatus. (9) The model generation apparatus according to (8), wherein the one or more labeled remote procedure calls are manually generated. (10) The model generating apparatus according to (8), wherein the one or more labeled remote procedure calls are automatically generated. (11) the at least one processor further comprises: (i) learning the dependencies between the calculated functions to form a model structure; and (ii) providing the model structure to form the model. The model generation device according to (8), wherein one or more obtained model parameters can be learned. (12) The model generation device according to (8), wherein the model is a Bayes net model. (13) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. An apparatus for automatically generating training data used to build a model used in recognizing one or more end-user transactions, the apparatus comprising: (i) generated at the client workstation. Creating the client workstation to mark the beginning and end of one or more end-user transactions; (i
i) To generate a remote procedure call labeled with an end-user transaction and serving as training data,
At least one processor capable of correlating a transaction mark with the one or more remote procedure calls received at the server; and connecting to the at least one processor to generate the training data. A memory for storing at least a part of an associated result. The at least one processor may further download a marking agent to the client workstation for use in marking the end-user transaction. The training data automatic generation device according to 1. (15) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A method of recognizing one or more end-user transactions, the method comprising: obtaining the one or more remote procedure calls;
Recognizing the one or more remote procedure calls based on training data associated with the one or more remote procedure calls. (16) the end-user transaction recognition step includes: (i) segmenting the one or more remote procedure calls into end-user transaction segments; and (ii) an end-user transaction function for each segment. (Iii) using the model generated from the training data to extract the extracted end user
Calculating the one or more end-user transactions from a transaction. The end-user transaction recognition method of claim 15, further comprising: (17) The end user transaction recognition method according to the above (16), wherein the model is a Bayes net model. (18) The end-user transaction calculation step includes: (i) assigning a function value associated with the Bayes net model to a corresponding extraction function; (Iii) determining a probability distribution based on the probability distribution
Selecting the function value to represent one or more end-user transactions. The end-user transaction recognition method of claim 17, further comprising: (19) The function value selecting step includes selecting the most promising function value for a predetermined extracted function to represent one or more end-user transactions. 3. The end-user transaction recognition method according to claim 1. (20) The end-user transaction recognition method according to (18), wherein the selected function value forms a representative class label of one or more end-user transactions. (21) To determine if the result is of sufficient quality,
The end-user according to claim 15, wherein at least a part of the result is compared with a quality metric.
Transaction recognition method. (22) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A method for generating a model for use in recognizing one or more end-user transactions, comprising: obtaining one or more remote procedure calls labeled by one or more end-user transactions. Calculating the one or more selected functions labeled by the one or more end-user transactions, wherein the model is learned from the labeled remote procedure call; and Steps for building the model from Model generating method characterized by comprising the flop, the. (23) The model generating method according to (22), wherein the one or more labeled remote procedure calls are generated manually. (24) The model generation method according to the above (22), wherein the one or more labeled remote procedure calls are automatically generated. (25) The model building step includes: (i) learning a dependency between functions calculated to form a model structure; and (ii) giving the structure to form the model. The model generating method according to (22), further comprising a step of learning one or more model parameters. (26) The model generation method according to (22), wherein the model is a Bayes net model. (27) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A method for automatically generating training data used to build a model for use in recognizing one or more end-user transactions, the method comprising: generating one or more at a client workstation. Generating the client workstation to mark the beginning and end of the end-user transaction of the remote server; and a remote server labeled by the end-user transaction and serving as the training data.
Correlating the end-user transaction with the one or more remote procedure calls received at the server to generate a procedure call. (28) The method of (27), wherein the generating step includes downloading a marking agent to the client workstation for use in the end-user transaction. (29) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A product for recognizing one or more end-user transactions, wherein, when executed, obtaining the one or more remote procedure calls; Recognizing the one or more remote procedure calls based on the training data obtained. (30) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A product for generating a model for use in recognizing one or more end-user transactions, wherein the one, when executed, is labeled with one or more end-user transactions.
Obtaining one or more remote procedure calls, wherein the model is trained from the labeled remote procedure calls and one or more selected ones labeled by the one or more end-user transactions Calculating a function; building the model from the selected function;
An article of manufacture comprising a machine-readable medium that includes one or more programs that perform the following. (31) The one generated at the client workstation from one or more remote procedure calls received at a server in communication with the client workstation in response to one or more end-user transactions. A product for automatically generating training data used to build a model for use in recognizing one or more end-user transactions, said client work when executed. Generating the client workstation to mark the start and end of one or more end-user transactions generated by the station; and a remote controller labeled by an end-user transaction and acting as the training data Implementing a step of correlating the end-user transaction by the said one or more remote procedure call received by the server to generate preparative procedure call, the 1
A product comprising a machine-readable medium containing one or more programs.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating the overall architecture of an end-user transaction recognition system according to an embodiment of the present invention in a network to which the present invention is applicable.

FIG. 2 shows an end user according to one embodiment of the present invention;
6 is a flowchart illustrating a transaction recognition method.

FIG. 3 illustrates an end user according to one embodiment of the present invention.
FIG. 3 is a block diagram for explaining components of a transaction model learning device.

FIG. 4 illustrates an end user according to one embodiment of the present invention.
It is a block diagram for explaining the component of a transaction function selector.

FIG. 5 illustrates an end user according to one embodiment of the present invention.
FIG. 2 is a schematic diagram for explaining a transaction Bayes Net model.

FIG. 6 illustrates an end user according to one embodiment of the present invention.
It is a block diagram for explaining the transaction Bayes Net learning system.

FIG. 7 illustrates an end user according to one embodiment of the present invention.
FIG. 3 is a block diagram illustrating a transaction recognizer.

FIG. 8 is a block diagram illustrating a Bayes Net classifier and related operations according to one embodiment of the present invention.

FIG. 9 illustrates an end user according to one embodiment of the present invention.
5 is a flowchart illustrating a method for use by a transaction recognizer.

FIG. 10 is a block diagram illustrating a system for automatically labeling remote procedure calls by an end-user transaction according to one embodiment of the present invention.

FIG. 11 is a generalized hardware diagram of an end-user transaction recognition system and / or a system for automatically labeling remote procedure calls by end-user transactions according to the present invention.
FIG. 2 is a block diagram for explaining an architecture.

[Explanation of symbols]

100 End User 101 End User Transaction (EU
T) 102 workstation (client) 103 remote procedure call (RP
C) 104 server 110 EUT recognition system 120 EUT model learning device 130 EUT model 140 EUT recognition device 300 EUT function selector 310 EUT Bayes Net learning system 400 EUT function type selector 401 EUT function subset selector 500 root node 500-1 to 500- N Lower node (child node) 600 Bayes Net structure learning module 610 Block 620 Bayes Net parameter learning module 700 RPC stream segmentation system 710 EUT function extractor 720 Bayes Net classifier 1000 End user 1001 Work load generator 1002 Workstation 1003 Server 1010 EUT marker / agent 1020 EUT label device 1030 RPC

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Joseph El Jellestein, United States 10562 New York, Ossing, Walden Road 41 (72) Inventor Irina Rish United States 10603 New York, White Plain, Castif A Avenue 37 (72) Inventor Jaram S. Tassacha United States 10598 Baldwin Road, Yorktown Heights, NY 1870 F-term (reference) 5B085 BG07 CC00 CC11 CC17 5B098 AA10 GA04 GA06

Claims (31)

[Claims] 1. A client workstation, corresponding to one or more end-user transactions, generated from one or more remote procedure calls received at a server in communication with the client workstation. An apparatus for recognizing said one or more end-user transactions, comprising: (i) obtaining said one or more remote procedure calls; and (ii) relating to said one or more remote procedure calls. At least one processor capable of recognizing the one or more end-user transactions, and a memory coupled to the at least one processor and storing at least a portion of a result associated with the operation of the end-user transaction recognition. Characterized by having End user transaction recognition device. 2. The at least one processor further comprising: (i) segmenting the one or more remote procedure calls into a plurality of end-user transaction segments; and (ii) an end-user transaction function for each segment. And (i
ii) performing the end-user transaction recognition operation by calculating the one or more end-user transactions from an end-user transaction function for each segment using a model generated from training data. 2. The end-user transaction recognition device according to claim 1, wherein: 3. The end-user transaction recognition apparatus according to claim 2, wherein said model is a Bayes net model. 4. The at least one processor,
(I) assigning a function value associated with the Bayes net model to the corresponding extracted function;
i) finding a subsequent probability distribution for each function value, (i
4. The end-user transaction recognition device according to claim 3, wherein a function representing one or more end-user transactions is selected based on the subsequent probability distribution. 5. The method of claim 1, wherein the selecting a function value comprises selecting a most likely function value for a given extracted function to represent one or more end-user transactions. The end-user transaction recognition device according to claim 4. 6. The end-user transaction recognition apparatus according to claim 4, wherein the selected function value forms a class label of one or more end-user transactions. 7. The end-user transaction of claim 1, wherein at least a portion of the result is compared to a quality metric to determine whether the result is of sufficient quality. Recognition device. 8. A client workstation that generates one or more remote procedure calls that correspond to one or more end-user transactions and are received at a server in communication with the client workstation. Apparatus for generating a model used in recognizing said one or more end-user transactions, comprising: (i) one or more remote procedure procedures labeled by one or more end-user transactions.
Obtaining a call; and (ii) one or more selected ones wherein the model has been learned from the labeled one or more remote procedure calls and labeled with the one or more end-user transactions. Calculating at least one function; and (iii) at least one processor capable of building the model from the selected function; and a result associated with the operation of connecting to the at least one processor and generating the model. And a memory for storing at least a part of the model generation device. 9. The apparatus of claim 8, wherein the one or more labeled remote procedure calls are generated manually. 10. The one or more labeled remote devices.
9. The model generation device according to claim 8, wherein the procedure call is generated automatically. 11. The at least one processor further comprising: (i) learning dependencies between the calculated functions to form a model structure; and (ii) the model structure to form the model. 9. The model generating apparatus according to claim 8, wherein one or more model parameters given in (1) can be learned. 12. The model generating apparatus according to claim 8, wherein said model is a Bayes net model. 13. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. An apparatus for automatically generating training data used to build a model used in recognizing said one or more end-user transactions, comprising: (i) generating at said client workstation; Generating the client workstation to mark the beginning and end of one or more end-user transactions to be performed;
To generate remote procedure calls that are labeled with the transaction and serve as training data, the end-user transaction
At least one processor capable of correlating a mark with the one or more remote procedure calls received at the server; and associated with an operation of connecting to the at least one processor and generating the training data. A memory for storing at least a part of the result; and an automatic training data generation device, comprising: 14. The system of claim 1, wherein the at least one processor is further operable to download a marking agent to the client workstation for use in marking the end-user transaction. 14. The training data automatic generation device according to 13. 15. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A method of recognizing said one or more end-user transactions, comprising: obtaining said one or more remote procedure calls; and based on training data associated with said one or more remote procedure calls. Recognizing the one or more remote procedure calls with an end user transaction recognition method. 16. The end-user transaction recognition step includes: (i) segmenting the one or more remote procedure calls into end-user transaction segments; and (ii) an end-user transaction for each segment. Extracting a transaction function; and (iii) calculating the one or more end-user transactions from the extracted end-user transactions for each segment using a model generated from the training data. The method according to claim 15, wherein 17. The method according to claim 16, wherein said model is a Bayes net model. 18. The end-user transaction calculating step includes: (i) assigning a function value associated with a Bayes net model to a corresponding extraction function; and (ii) for each function value. Finding a later probability distribution; and (iii) selecting a function value to represent one or more end-user transactions based on the later probability distribution. 18. The end-user transaction recognition method according to claim 17. 19. The function value selecting step includes the step of selecting the most promising function value for a given extracted function to represent one or more end-user transactions. 19. The method for recognizing an end-user transaction according to claim 18. 20. The method of claim 18, wherein the selected function values form a class label representative of one or more end-user transactions. 21. The method of claim 15, wherein at least a portion of the result is compared to a quality metric to determine whether the result is of sufficient quality. 22. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A method for generating a model for use in recognizing one or more end-user transactions, comprising obtaining one or more remote procedure calls labeled by one or more end-user transactions. And wherein said model is learned from said labeled remote procedure call and said one or more end user
A method of generating a model, comprising: calculating one or more selected functions labeled by a transaction; and building the model from the selected functions. 23. The one or more labeled remote devices.
The method of claim 22, wherein the procedure call is generated manually. 24. The one or more labeled remote devices.
The method of claim 22, wherein the procedure call is generated automatically. 25. The model building step comprising: (i) learning dependencies between functions calculated to form a model structure; and (ii) providing the structure to form the model. Learning one or more model parameters.
3. The model generation method according to 2. 26. The method according to claim 22, wherein the model is a Bayes net model. 27. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A method for automatically generating training data used to build a model for use in recognizing the one or more end-user transactions, the method comprising: generating at a client workstation 1 Generating the client workstation to mark the beginning and end of one or more end-user transactions; and a remote procedure labeled by an end-user transaction and serving as the training data. The training data automatic generation method characterized by comprising the steps of: correlating the end-user transaction by said one or more remote procedure call received by the server to generate catcher call. 28. The method of claim 27, wherein the generating step includes downloading a marking agent to the client workstation for use in the end-user transaction. 29. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A product for recognizing the one or more end-user transactions, wherein when executed, obtaining the one or more remote procedure calls; and the one or more remote procedure calls. Recognizing the one or more remote procedure calls based on training data associated with the product; and a machine-readable medium including one or more programs that perform the following. 30. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A product for generating a model for use in recognizing said one or more end-user transactions, said one product being, when executed, labeled with one or more end-user transactions. Obtaining said remote procedure call; one or more selected functions wherein said model is trained from said labeled remote procedure call and labeled by said one or more end-user transactions. Calculating the Constructing said model from said functions; and a machine-readable medium containing one or more programs for performing the following. 31. A client workstation that responds to one or more end-user transactions and is generated from one or more remote procedure calls received at a server in communication with the client workstation. A product for automatically generating training data used to build a model for use in recognizing the one or more end-user transactions, the client, when executed, comprising: Generating the client workstation to mark the start and end of one or more end-user transactions generated by the workstation; and serving as the training data, labeled by an end-user transaction. Fruit Correlating the end-user transaction with the one or more remote procedure calls received at the server to generate a remote procedure call. A product characterized by including a reading medium.